chore(release): stage first RxJS 9 beta safely

[benlesh]

Summary

• replace the public rehearsal-package proposal with exact-tarball npm dry runs and stage-only trusted-publisher previews
• separate master checks, PR-only checks, and advisory checks in the release policy
• route protected candidate-tag writes through the scoped release App
• extend the strict release doctor across the App installation, rulesets, npm-stage environment, and trusted-publisher inputs
• mark P6.9 done while keeping P6.10 NEXT through private staging, WebAuthn approval, and public verification

No RxJS runtime API, export, type, package-format, or apps/rxjs.dev changes are included.

Verification

• pnpm run release:check (67 tests)
• pnpm run test:workflows
• 16 credential-free npm 11.18.0 dry runs over the four exact 9.0.0-beta.0 tarballs
• git diff --check